1 / 10

The Common Criteria for Information Technology Security Evaluation

The Common Criteria for Information Technology Security Evaluation. Overview Glen F. Marshall, Siemens. Topics. What is the Common Criteria? Key concepts Targets of Evaluation Security Requirements Assurance Requirements Environmental Requirements Testing Other Information Resources.

aliza
Download Presentation

The Common Criteria for Information Technology Security Evaluation

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. The Common Criteriafor Information TechnologySecurity Evaluation Overview Glen F. Marshall, Siemens

  2. Topics • What is the Common Criteria? • Key concepts • Targets of Evaluation • Security Requirements • Assurance Requirements • Environmental Requirements • Testing • Other Information Resources

  3. What is the Common Crtieria? • An international standard ( ISO/IEC15408) for computer security evaluation • A framework in which... • Computer system purchasers and users can specify their security requirements • Vendors can make claims about the security attributes of their products • Testing laboratories can evaluate products to determine if they actually meet the claims.

  4. Targets of Evaluation • A system design which claims to satisfy security requirements • A product or system for which security claims are made Note: The term “target of evaluation” is typically abbreviated as “TOE”.

  5. Security Requirements • Derived from • Policies, e.g., desired states and outcomes of privacy protections, confidentiality, and assurance of security within the TOE. • Risk analysis, identifying threats for which mitigation is required within the TOE • Environmental analysis, identifying factors that may influence the formation of policy or mitigate risks, but which are generally outside the TOEs' scope.

  6. Security Requirements • Document artifacts • Protection Profile (PP) - identifies detailed security requirements relevant to a particular purpose, e.g. a set of related use cases. • Security Functional Requirements (SFRs) - the individual security functions to be provided within a TOE. • Security Target (ST) - a document that identifies the security properties of the TOE.

  7. Assurance Requirements • Assurance is the level of confidence that the policies are enforced and risks are mitigated within the TOE. • Assurance requirements must be supported by the TOE • Assurance activities are ongoing, often periodic, and typically performed in the course of system operation

  8. Assurance Requirements • Security Assurance Requirements (SAR) describe the detailed actions during development, implementation, and operation the TOE that will assure its compliance with the claimed security functionality. • Evaluation Assurance Level (EAL) is a numerical rating assigned to the TOE to reflect the SARs to be fulfilled. EALs are predefined packages (in ISO/IEC 15408-3) of SARs with a given level of strictness.

  9. Testing • NIST’s National Voluntary Laboratory Accreditation Program (NVLAP) accredits Common Criteria testing laboratories in the US. • CCHIT security criteria are derived, in part, from the Common Criteria. However, the rigor of the testing laboratories was deemed too expensive. • Use of the Common criteria in US Federal system procurement is mandatory.

  10. Resources • Common Criteria Project Portal http://www.commoncriteriaportal.org/ • NIST’s Common Criteria sitehttp://csrc.nist.gov/cc/ • Common Criteria document downloadhttp://www.niap-ccevs.org/cc-scheme/cc_docs/ • CC used to identify and classify security standardshttp://www.healthitsecurity.net/wiki/

More Related